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A metliod and apparatuses for sending message to a mobile 
station by addressing the hardware part. 

The present invention relates in general to handling of messages, particularly 
short message service (SMS) messages in mobile communications networks, 
and in particular to finding the appropriate terminating address of a SMS 
message. 



BACKGROUND 



Short Message Service (SMS) has been used in mobile communications 
networks to enable different subscribers to send short text messages to each 
other. The Mobile Subscriber ISDN Number (MSISDN), i.e. the phone 
number of the mobile subscriber is utilised as the identifying addressing 
information, since the SMS content is intended for a particular user. The 
SMS message and the MSISDN are provided to a SMS controller, which 
temporary stores the SMS and searches for the intended terminating mobile 
subscriber. In searching for the terminating mobile subscriber, the SMS 
controller interacts with a Home Location Register (HLR) for achieving 
identity data. International Mobile Subscriber Identity (IMSI), of a Subscriber 
Identity Module (SIM) associated with the terminating mobile subscriber. The 
HLR also provides an address of a Mobile Switching Centre (MSG) through 
which the SIM can be reached. By using this data, the message can be 
routed to the appropriate terminating mobile subscriber. 

The SMS concept is. today also used for several network- based applications, 
in which SMS is used to push data directly to a client in the phone. 
Examples of this are Over-The-Air (OTA) SMS, Multimedia Message Service 
(MMS) notifications and SIM Toolkit updates. In order to fit into the basic 
SMS concept, also those applications are using MSISDN as the address for 
reaching either the SIM card or the mobile terminal. 
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As long as tiiere is a one-to-one correspondence between the MSISDN, the 
IMSI and the identity of the mobile terminal, e.g. defined by the International 
Mobile Equipment Identity (IMEI) or the IMEI extended with the software 
version (IMEISV), either of these quantities can be used for addressing 
purposes, giving the same terminating terminal, SIM • and subscriber. 
However, by introducing more flexible solutions allowing e.g. a subscriber to 
move the SIM card between different terminals, or allowing a single mobile 
subscriber to have more than one SIM card addressed with the same 
MSISDN, addressing problems may arise. 

A part of the work within 3GPP is directed to standardise a function to 
automatically detect when a SIM card identified by IMSI is used in a 
terminal identified by IMEISV for the first time. This function is named 
Automatically Device Detection (ADD). The information comprising at least 
MSISDN, IMSI and IMEISV is stored in a terminal capability server. The 
terminal capability server also has the capability to forward the relevant 
information to external applications, such as Device Management Systems 
(DMS). Those applications can use part of the information as triggers to 
different events. Examples are that SMS with new GPRS settings can be sent 
out to terminals that require those settings before they can be used for MMS, 
Wireless Application Protocol (WAP) or other data services. The terminal 
capability server thereby allows connected applications to solve the problems 
of moving the SIM card to different terminals. However, the problems remain 
for applications not connected to any updated terminal database and for the 
use of dual SIM cards. 

SUMMARY 

A general problem with prior art SMS systems is that there is an 
indefmiteness in addressing hardwsure parts, e.g. SIM cards or mobile 
terminals, of a mobile subscriber in a mobile communications network. A 
further problem with prior-art solutions is that the simultaneous use of more 
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than one SIM card for the same mobile subscriber makes it impossible to 
ensure that an SMS message reaches the intended hardware. 

A general object of the present invention is therefore to provide methods, 
devices and systems in which also hsirdware associated identifications can 
be used as addressing data when sending messages. A further object of the 
present invention is to provide such methods, devices and systems that 
requires as small changes as possible in present standardised systems. 

The objects mentioned above are achieved by methods, devices and systems 
according to the enclosed patent claims. In general words, a message, 
typically a SMS message, intended for a specific hardware item is provided 
from an application node to a message controller together with hardware 
identification data, e.g. IMSI or IMEISV, specifying the intended terminating 
hardware. The message controller and a location updated subscriber 
database, e.g. a HLR, having stored information about the intended 
terminating hardware, interacts and a further handling of the message is 
decided based on the provided hardware identification data and on data 
stored in the location updated subscriber database. Preferably, the further 
handling is based on a comparison between hardware identification data 
stored in the location updated subscriber database and the provided 
hardware identification data. In one embodiment, the hardware identification 
data is provided to the location updated subscriber database, in which a 
comparison is made with the stored data, resulting in the retrieval of IMSI 
and a relevant switching or support node address of the hardware. In 
another embodiment, the application node also provides the subscriber 
identity, e.g. the MSISDN, to the riiessage controller. The message controller 
interacts with the location updated subscriber database to achieve hardware 
identification data (e.g IMSI and/or IMEISV) from the location updated 
subscriber database. If the hardware identification data provided by the 
application node, at a comparison made at the message controller, 
corresponds to the hardware data achieved from the location updated 
subscriber database, the message is transmitted to the switching or support 
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node address also achieved from the location updated subscriber database. 
Otherwise error functionalities are applied. 

An advantage with the present invention is that any indefiniteness in 
addressing hardware intended as terminating items of a message is removed. 
Another advantage of the present invention is that a very limited amount of 
changes in present standards has to be performed. 

BRIEF DESCRIPTION OF THE DRAWINGS 

The invention, together with further objects and advantages thereof, may best 
be understood by making reference to the following description taken together 
with the accompanying drawings, in which: 

FIG. 1 is a schematic block diagram of a mobile communications system 
supporting SMS; 

FIGS. 2 A and 2B are schematic illustrations of stored data of typical HLR 
units; 

FIG. 3 is a schematic block diagram of an embodiment of a message 
controller according to the present invention and its surrounding units; 

FIG. 4 is a schematic block diagram of embodiments of a message 
controller and a HLR according to the present invention; 

FIG. 5 is a schematic block diagram of other embodiments of a message 
controller and a HLR according to the present invention; 

FIG. 6 is a flow diagram of the main steps of an embodiment of a method 
according to the present invention; and 

FIG. 7 is a flow diagram of the main steps of another embodiment of a 
method according to the present invention. 

DETAILED DESCRIPTION 

In the present disclosure, the term "hardware identification data" comprises 
identification data associated with all kinds of hardware, including e.g. SIM 
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cards, mobile terminals etc. Hardware identification data may thus comprise 
e.g. IMSI, IMEI, IMEISV as well as combinations thereof. 

In order to better understand the present invention, first a short overview of 
a prior-art communications system supporting SMS is illustrated and 
discussed. 

Fig. 1 illustrates such a mobile communications system 1. A number of 
users or mobile subscribers 10:0, 10:1 have access to one or more mobile 
terminals 14:0, 14:1, 14:2. Each subscriber 10:0, 10:1 is characterised by a 
unique identification number, MSISDN. There is typically a proprietary 
relation 12 between the subscribers 10:0, 10:1 and the mobile terminals 
14:0, 14:1, 14:2 the subscriber uses. The mobile terminals 14:0, 14:1, 14:2 
have also a unique identity, defined by the IMEISV. In order to associate the 
subscriber and the mobile terminal 14:0, 14:1, 14:2, a SIM card 16:0, 16:1, 
16:2 is introduced in the mobile terminal 14:0, 14:1, 14:2. The position of 
the SIM card 16:0, 16:1, 16:2 constitutes the connection with the mobile 
terminal 14:0, 14:1, 14:2, while the connection between the SIM card 16:0, 
16:1, 16:2 and the subscriber 10:0, 10:1 is made by an agreement registered 
in a database. The SIM card 16:0, 16:1, 16:2 does also have an identity, 
defined by the IMSI. As a summary, the subscriber is identified by the 
MSISDN, the SIM card by the IMSI and the mobile terminal by the IMEISV. 
Each mobile terminal 14:0, 14:1, 14:2 is connected by means of wireless 
communication links 18 to respective base station 22:0, 22:1, The base 
stations 22:0, 22:1 are typically arranged to serve several mobile terminads 
simultaneously. The base stations 22:0, 22:1 are connected to mobile 
switching centres 20:0, 20:1. The communications system 1 keeps track of 
to which mobile switching centre (MSC) 20:0, 20:1 each terminal 14:0, 14:1, 
14:2 is connected, by updating address fields of a HLR 50. 

When sending a normal SMS, a subscriber 10:0 may type a message at his 
originating mobile terminal 14:0 and request that the SMS should be sent to 
a certain terminating subscriber 10:1, identified by a MSISDN. The message 
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and its associated MSISDN are transmitted over a connection 26 to the core 
network 30 of the communications system. In the present illustrated system, 
the SMS is transmitted in a single SS7 packet through the core network 30 
to a SMS controller 40. The communication over the connection 74 between 
the core network 30 and the SMS controller is governed by an interface 52 
defined by protocols of 3GPP standards, and comprises the message and the 
MSISDN data. The SMS message is received by a SMS interworking MSG 42 
and the SMS is at least temporary stored in a controller storage 44. 

A SMS gateway MSG 46 is connected to the controller storage 44 and 
interacts with the HLR 50 over an interface 54 to achieve address data 
associated with the intended terminating subscriber. The MSISDN is 
provided 78 to the HLR 50, which uses its databases to return 80 
corresponding IMSI data and the address of the MSG presently serving the 
subscriber. The communication between the SMS controller 40 and the HLR 
50 takes place in this embodiment according to a Mobile Application Part 
(MAP) standard of a 3GPP specification. The SMS gateway MSG 46 initiates a 
transmission of the SMS message with the associated IMSI to the MSG 
address over the connection 76 and the SS7 network 30. The IMSI is used by 
the MSG during paging of the mobile terminal. The addressed MSG 20:1 
receives the message and the IMSI data over the connection 24 and forwards 
it to the mobile terminal 14:1, having the SIM card 16:1 associated with the 
IMSI data. In this manner, the intended terminating subscriber 10:1 is 
reached by the SMS. 

One important part for being able to provide this service is the HLR 50. Fig. 
2a schematically illustrates part of the content of an HLR in a typical SMS 
case. The HLR comprises a number of entries, illustrated as rows of data. 
Each entry comprises an MSISDN number 101, an IMSI number 102, a 
present MSG address 104 and in this enibodiment also an IMEISV number 
103. The entries thereby defme the present relations between the hardware 
identification data, i.e. IMSI and IMEISV, and the MSISDN. Furthermore, the 
present location in the communications network is given by the MSG 
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address. This HLR 50 is updated continuously. This means that if a 
subscriber places his SIM card in a new mobile terminal, the IMEISV 
number of the corresponding entry is updated for reflecting the new 
hsa-dware. 

Other applications have been developed, utilising the SMS concepts for 
transmitting data to the subscriber, terminal or SIM card. Non-exclusive 
examples are notification of e-mail, notification of mutimedia message 
service (MMS) messages, vocie mail, WAP push, SIM toolkit SMS or OTA 
configuration SMS. Such application nodes are illustrated by 70:1, 70:2, 
70:3 in Fig. 1. The SMS messages generated by these applications 70:1, 
70:2, 70:3 sire provided, typically by an Internet network 60, to an 
application node interworking unit 48 of the SMS controller 40. Other types 
of networks or connections may also be used to connect the SMS controller 
40 and the applications 70:1, 70:2, 70:3. The message, together with a 
MSISDN identifying the terminating subscriber is transmitted over a 
connection 58 using e.g. a Short Message Peer-to-Peer (SMPP). The SMS 
message is then forwarded in the same manner as for subscriber originated 
SMS messages. 

There is, however, a principal difference between some application SMS 
messages and normal subscriber originated SMS messages. The subscriber 
originated SMS messages are in all real situations intended for the 
terminating subscriber. However, application SMS messages may instead be 
intended to reach the SIM card or the mobile terminal instead of the actual 
subscriber. If a subscriber moves the SIM card to a new terminal, an 
application that generates mobile terminal terminating SMS messages has to 
be informed. Furthermore, if MSISDN is moved, using e.g. Dual SIM 
procedures, from a SIM card to another SIM card, also SIM terminating SMS 
messages will miss the targeted SIM card. The concept of dual SIM may also 
be extended to more than two SIM cards. 



wo 2005/094097 PCT/SE2004/000481 

, The principles for an OTA configuration SMS can be described witJi reference 
to Fig. 1 using a particular implementation of ADD. When a subscriber with 
a new terminal is detected, a possible procedure can be as follows. The MSG 
node 20:1 in either the home public land mobile . network (HPLMN) or the 
visited public land mobile network (VPLMN) fetches IMEISV for all users 
upon Location Update, type IMSI Attach or Normal. The MSG 20:1 sends the 
received IMEISV in the Update Location update operation to the HPLMN HLR 
node 50. The HLR 50 stores IMEISV together with other subscriber data, as 
described above. The HLR 50 sends a message to a terminal capability server 
72. In the presently illustrated system, the terminal capability server 72 
checks the received information against an internally stored configuration 
data file. The terminal capability server 72 sends a new configuration order 
to a DMS, illustrated as the application node 70:1. Any appropriate data can 
be attached. The DMS 70:1 processes the configuration orders on regular 
intervals and sends appropriate configuration parameters based on received 
device data and access point name (APN) to identified subscribers. The DMS 
70:1 sends an OTA SMS, addressed with the MSISDN, to a SMS controller 
40 for fiirther delivery according to the procedures described further above. 
The terminal capability server 72, here provides the necessary identity 
information for being able to perform the OTA configuration. 

A further complication arises when the concept of dual (or multiple) SIM is 
introduced. Many operators today have solutions with more than one SIM- 
card associated with the same MSISDN number. These solutions are often 
named Dual SIM, GSM Twin Cards or similar. With these solutions, a 
subscriber do not need to move the SIM card between the terminals if the 
subscriber has more than one terminal. Several terminals can 
simultaneously be used for mobile originating calls, but only one can be 
used for mobile terminated calls and mobile terminated SMS messages. A 
typical case is a user with both a hand -held terminal as well as a car- 
mounted terminal. Another typical case is a user with a large advanced 
smartphone and a small mobile telephone. It is then up to the subscriber to 
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specify to the network which of these terminals that should be marked in 
HLR as currently active for mobile terminated calls and SMS messages. 

Fig. 2b schematically illustrates parts of the content of a HLR in a typical 
Dual-SIM case. Each SIM card, i.e. each IMSI, corresponds to one entry of 
the HLR 50. However, since several IMSI's can be associated with the same 
MSISDN, only the IMSI selected for terminating incoming calls has a 
MSISDN number defined. In this particular example, the subscriber 
MSISDN- 1 has Dual-SIM's with IMSI numbers IMSI-1 and IMSI-2. IMSI-1 is 
selected as the one that should receive incoming calls. Likewise, the 
subscriber MSISDN-3 has marked IMSI-4 as the "active" SIM card and has 
IMSI-3 "passive". 

However, if an application node intends to send a SMS message to a certain 
SIM card or mobile terminal, the corresponding MSISDN can be associated 
with another IMSI or IMEISV. This results in that the application node can 
not guarantee that the SMS really reaches the intended hardware. For 
instance, with reference to Fig. 2b, if IMSI-2 is the' intended target, the 
associated MSISDN, i.e. MSISDN- 1, is not active and furthermore MSISDN- 1 
is instead actively associated with another IMSI, namely IMSI-1. 

The information used in the described embodiments is mainly constituted by 
IMSI, IMEI or IMEISV and MSISDN. However, other types of identification 
data for mobile terminals, subscriber identity modules and mobile 
subscribers can be used in an equivalent manner. 

The general solution of the present invention comprises the addition of 
parameters of the interface 56 protocol controlling the communication 
between the application node 70:1, 70:2, 70:3 and the SMS controller 40. 
These parametisrs comprise hardware identification data, typically at least 
one of subscriber identification module identification data (IMSI) and mobile 
equipment identification data (IMEI or IMEISV). 
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^, Fig. 3 illustrates an embodiment of a SMS controller 40 according to the 
present invention together with parts of the surrounding communications 
system. An SMS message and an associated MSISDN number MSISDNx are 
sent from an application node 70 to the SMS controller over the connection 
58. According to this embodiment of the present invention, in addition to 
this data, also associated IMSI data IMSIx is attached. When the SMS GMSC 
46 interrogates the HLR 50 with a message requesting routing information 
for the SMS, the MSISDNx data is used as identification. The returned IMSI 
data IMSIy (and also MSC address data) corresponds to the SIM card that is 
the "active" receiver of calls and SMS's according to the databases of the HLR 
50. The SMS GMSC 46 compares in a comparator 45 the IMSIy data from 
the HLR 50 and the IMSIx data received by the connection 43 to verify that 
they are the same. If they indeed are the same, implicitly, the MSC address 
is also the MSC address associated with IMSIx and provided by the 
connection 47 to join the SMS message provided by 41. The SMS send 
procedure then continues as normal, by initiating a transmission of the 
SMS. The data provided on the connection 76 then comprises the SMS 
message, the MSC address and the IMSIx data. 

If the IMSI received from the HLR 50 is not the same as the one received 
from the application node, alternative error handling procedures are 
possible. In one embodiment, an error message 49 is provided to the 
application node, telling that the intended terminating hardware can not be 
reached by use of the MSISDN number as only address. In an alternative 
embodiment, the SMS message could be stored for a while, and a new HLR 
interrogation can be made after a delay time, to check if there are any 
changes in choice of active SIM cards. Here, an error message could be 
returned e.g. after a certain number of trials or after a certain time. 

In accordance with the embodiment of Fig. 3, with a simple update of the 
SMPP protocol, or other protocol controlling the communication between the 
application node and the SMS controller, i.e. the interface 56, the 
information from the HRL can be used to verify that the correct terminal or 
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SIM card is addressed. No changes in t±ie present standardised protocols for 
the interface 54 between the SMS controller 40 and the HLR 50 have to be 
performed. 

However, if further changes are performed also at the interface 54, further 
advantages can be reached. Fig. 4 illustrates another embodiment of a SMS 
controller according to the present invention. An SMS message is sent from 
an application node 70 to the SMS controller over the connection 58. The 
MSISDN number can also optionally be provided. According to this 
embodiment of the present invention, in addition to this data, also 
associated IMSI data IMSIx is attached. According to this embodiment, the 
SMS GMSC 46 interrogates the HLR 50 with a message according to a 
modified standard. Here routing information for the SMS is requested based 
on the IMSIx data 81 used as identification. In the return, MSG address data 
MSCx 79 corresponds to the SIM card having the identity of IMSIx is 
provided, regardless of if the SIM card is marked as active or not. This is 
provided according to information stored in the databases of the HLR 50. 
The SMS GMSC 46 adds the MSCx address to the message and IMSIx data. 
The SMS send procedure then continues as normal, by initiating a 
transmission of the SMS. The data provided on the connection 76 then 
comprises the SMS message, the MSCx address and the IMSIx data. 

If the MAP interface 54 is updated to be able to transfer also IMSI as 
identifying information, the correct terminal can be addressed independent 
of which SIM card is marked as active for mobile terminated SMS in the case 
of Dual SIM solutions. In such a case, the need for error signalling is not as 
vital as in the embodiment of Fig. 4. 

Fig. 5 illustrates yet another embodiment of a SMS controller according to 
the present invention. A SMS message is sent from an application node 70 to 
the SMS controller over the connection 58, together with the MSISDN 
number MSISDNx. According to this embodiment of the present invention, in 
addition to this data, also associated IMEI data IMEIx is attached. According 
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to this embodiment, the SMS GMSC 46 interrogates the HLR 50 with a 
message comprising the MSISDNx 80. In the return, MSG address data 
MSCy 79 corresponds to the terminaJ being associated as active in relation 
to the MSISDNx. Also, the corresponding IMSIy and IMEIy are provided to 
the SMS GMSC 46. The SMS GMSC 46 compares in a comparator 45 the 
IMEIy data from the HLR 50 and the IMEIx data received by the connection 
43 to verify that they are the same. If they indeed are the same, the MSG 
address MSCy is the same as MSCx, the IMSIy is the same as IMSIx, and are 
provided by the connection 47 to join the SMS message provided by 41. The 
SMS send procedure then continues as normal, by initiating a transmission 
of the SMS. The data provided on the connection 76 then comprises the SMS 
message, the MSCx address and the IMSIx data. 

If the IMEI received from the HLR 50 is not the same as the one received 
from the application node, alternative error handling procedures are possible 
in analogy with the embodiment of Fig. 3. An error message 49 may be 
provided to the application node, telling that the intended terminating 
hardware, in this case a certain mobile terminal, can not be reached by use 
of the MSISDN number as only address. In an alternative embodiment, the 
SMS message could be stored for a while, an a new HLR interrogation can be 
made after a delay time, to check if there are any changes in choice of active 
terminal equipment. Here, an error message could be returned e.g. after a 
certain number of trials or after a certain time. 

Note that in the embodiment of Fig. 5, the HLR 50 is assumed to include 
records of IMEISV (or IMEI) data. In earlier embodiments it does not matter 
whether or not the HLR 50 comprises IMEI or IMEISV records, since such 
data is not used. 

In principle, also IMEI would be possible to use in a setup similar to the 
embodiment of Fig. 4. However, searching for a MSG address based solely on 
an IMEI number could be difficult to implement in reality. 
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In yet another embodiment, the data received by the SMS controller 40 over 
the interface 56 comprises both IMS! and IMEISV. The SMS GMSC 46 
provides the IMSI to the HLR 50 over the interface 54, but receives IMEISV 
in return. The IMEISV is then used for comparing the originally intended 
terminating hardware with the one stored in the HLR 50. This could be used 
to ensure that the SIM card is situated in the correct phone. This could be a 
complement to the use of a terminal capability server 72. 

In the present disclosure, SMS is used as an example message system. The 
present invention can, however, also be applied to other message systems, 
e.g. Unstructured Supplementary Service Data (USSD). Likewise, an SMS 
controller is used as a model of a general message controller. In the 
described embodiments, a location updated subscription database is 
exemplified by a HLR. However, other subscriber databases having updated 
location data, such as e.g. Home Subscriber Servers (HSS), can also be 
utilised. The address received from the location updated subscription 
database refers to a switching or support node, which in the described 
embodiment is exemplified by a MSG. However, other types of switching or 
support nodes, such as a . SGSN in GPRS or 3G systems can also be 
addressed. 

Furthermore, in the embodiments above IMEISV has been used for referring 
to the hardware identity of the mobile terminal. Since IMEISV comprises the 
IMEI and an extension defining the actual software version, any messages 
addressed to the mobile terminal that is independent on the software version 
can equally well be addressed by only the IMEI. In other words, both IMEI 
and IMEISV may serve as references to the mobile terminal hardware. 

Fig. 6 illustrates a flow diagram of the main steps of an embodiment of a 
method according to the present invention. The procedure starts in step 200. 
In step 210, a message and hardware identification data is transferred from 
an application node to a message controller. An interaction step 212 between 
the message controller and a location updated terminal database, typically 
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• an HLR. comprises in the present embodiment three part steps 214, 216 and 
218. In step 214, the hardware identification data is sent to the HLR as a- 
part of an interrogation for a switching or supporting node address. In step 

216, the HLR retrieves the address that corresponds to the hardware 
identification data, and in step 218, this address data is returned to the 
message controller. A step 220 of further managing of the message 
comprises in this embodiment the step 224 of initiating of the transmission 
of the message according to the address received from the HLR. The 
procedure ends in step 299. 

Fig. 7 illustrates a flow diagram of the main steps of another embodiment of. 
a method according to the present invention. The procedure starts in step 
200. In step 210, a message and (first) hardware identification data is 
transferred from an application node to a message controller. The 
terminating subscriber identification number is transferred in step 211, 
together with the message or separately. An interaction step 212 between the 
message controller and a location updated terminal database, typically an 
HLR, comprises in the present embodiment three part steps 213, 215 and 

217. In step 213, the subscriber identification number is sent to the HLR as 
a part of an interrogation for a switching or supporting node address. In step 
215, the HLR retrieves the address that corresponds to the subscriber 
identification number sind also a corresponding (second) hardware 
identification data. In step 217, this address data and hardware 
identification data is returned to the message controller. A step 220 of 
further managing of the message comprises in this embodiment the part 
steps 221 to 224. In step 221, the hardware identification data received from 
the HLR and the application node, respectively, are compared. If the 
hardware identification data, as decided in step 222 are correspondent data, 
the procedure continues to step 224, where initiating of the transmission of 
the message according to the address received from the HLR takes place. If it 
in step 222 is concluded that the hardware data does not agree, the 
procedure continues to step 223, where an error handling procedure is 
performed. The procedure ends in step 299. 
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The embodiments described above are to be understood as a few illustrative 
examples of the present invention. It will be understood by those skilled in the 
art that various modifications, combinations and changes may be made to the 
embodiments without departing from the scope of the present invention. In 
particular, different part solutions in the different embodiments can be 
combined in other configurations, where technically possible. The scope of the 
present invention is, however, defined by the appended claims. 



